A DDoS attack traffic detection method based on deep learning

Abstract

The present invention relates to the technical field of network attack and defense, and in particular to a DDoS attack traffic detection method based on deep learning, the method comprising: parsing a current data stream sent by a terminal device to obtain a feature sequence of multiple data packets; forming a time series feature matrix based on the feature sequences of the multiple data packets and inputting the matrix into a target deep learning model for traffic detection to obtain a model detection result, wherein the target deep learning model is obtained by training an initial deep learning model; if the model detection result is DDoS attack traffic, the terminal device sends an alarm message to a display interface, if the terminal device receives a confirmation indication that the DDoS attack traffic of a user is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected, and if the terminal device receives a confirmation indication that the DDoS attack traffic of the user is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic.

Description

Technical Field

[0001] The present invention relates to the field of network attack and defense technology, and in particular to a DDoS attack traffic detection method based on deep learning. Background Art

[0002] Distributed Denial of Service (DDoS) is a group attack that uses hundreds or even thousands of compromised hosts that have installed attack processes to launch attacks simultaneously. It exploits some defects in network protocols and operating systems, and uses deception and camouflage strategies to launch network attacks. It uses hundreds or thousands of attack proxy hosts to send a large number of disguised service request packets whose real sources cannot be identified to the target host. The services requested by these packets often consume a large amount of system resources or network bandwidth, causing the system or network to be overloaded and paralyzed and stop providing normal network services. This network composed of devices that launch attacks is called a "botnet". The direct manifestations of DDoS attacks include network congestion, system downtime, slow response, etc., which cannot process normal requests, affect normal user access, cause economic losses, and may even be hacked and stolen by hackers during the attack, endangering network security.

[0003] The "distributed" feature is one of the main reasons why DDoS poses a huge security threat. Attackers usually control multiple devices and incorporate them into a "botnet" by hacking into users with weak passwords, unpatched servers, or executing malicious code through phishing and fraud. Attackers can manage botnets through command and control servers, send attack instructions to various devices in the network, and generate a large amount of traffic containing forged information to carry out large-scale, difficult-to-trace DDoS attacks. Because the attacker's control behavior is somewhat hidden, it is difficult for users to detect abnormal behavior of their devices in time. As of the first half of 2020, the number of hosts infected with computer malicious programs in my country was about 3.04 million.

[0004] The current mainstream response strategy for DDoS attacks is to identify and clean the traffic flowing into the network at the communication end or intermediate node to prevent invalid access to the server, and use methods such as traffic analysis to track the devices in the botnet. However, as the scale of the botnet continues to expand, the pressure of server-side traffic cleaning will become greater and greater. Traffic cleaning at the source end (local routing node) can prevent attacks early, but the attack traffic in a single area may be difficult to detect before it forms a scale, and it is difficult to deploy on a large scale. As the main source of DDoS security threats, the distributed characteristics of botnets increase the difficulty of tracking the devices in them. Even if the infected devices are shut down in time, there will still be a steady stream of infected devices joining the botnet to attack. If the scale of the botnet cannot be controlled, the work of preventing and controlling DDoS attacks will always be in a passive position. The devices in the botnet are often controlled by malicious programs without the knowledge of the users, making it difficult to control the scale of the botnet from the root, which needs to be solved urgently. Summary of the invention

[0005] The present invention provides a DDoS attack traffic detection method based on deep learning to solve the problems that although the current strategy for dealing with DDoS attacks can prevent attack behaviors, the attack traffic in a single area may be difficult to detect before it forms a scale, and the distributed characteristics of botnets increase the difficulty of tracking devices.

[0006] A first aspect of the present invention provides a DDoS attack traffic detection method based on deep learning, comprising the following steps: obtaining a current data stream sent by a terminal device, parsing the current data stream to obtain a feature sequence of multiple data packets; forming a time series feature matrix based on the feature sequences of the multiple data packets and inputting it into a target deep learning model for traffic detection to obtain a model detection result, wherein the target deep learning model is obtained by training an initial deep learning model, and the initial deep learning model is composed of a one-dimensional convolutional neural network, a long short-term memory network layer and a first fully connected layer; if the model detection result is DDoS attack traffic, the terminal device sends an alarm message to a display interface, if the terminal device receives a confirmation indication from a user that the DDoS attack traffic is normal traffic, then the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected, if the terminal device receives a confirmation indication from a user that the DDoS attack traffic is abnormal traffic, then the DDoS attack traffic is determined to be abnormal traffic.

[0007] Optionally, a time series feature matrix is ​​formed based on the feature sequences of the multiple data packets and input into a target deep learning model for traffic detection to obtain a model detection result, including: using the convolution layer of the one-dimensional convolutional neural network to capture the spatial dependency between adjacent bytes of different lengths of a single data packet feature sequence in the time series feature matrix to obtain a high-dimensional data feature matrix, and slicing the high-dimensional data feature matrix to obtain a packet-level feature sequence, and inputting the packet-level feature sequence into the second fully connected layer of the one-dimensional convolutional neural network to obtain a one-dimensional data stream feature sequence, wherein the one-dimensional convolutional neural network includes two convolutional layers and a second fully connected layer; inputting the one-dimensional data stream feature sequence into the long short-term memory network layer to obtain an output sequence, and inputting the output sequence into the first fully connected layer, performing a nonlinear transformation through a first preset activation function, and calculating the probability distribution of the classification through a second preset activation function to obtain the model detection result based on the probability distribution.

[0008] Optionally, before obtaining the current data stream sent by the terminal device, it includes: obtaining an attack data stream with obvious attack characteristics; using a preset tool to identify and remove invalid data packets in the attack data stream to obtain data packets to be extracted; based on the data packets to be extracted, classifying them according to spatiotemporal characteristics, header characteristics, and load characteristics to obtain data packets to be trained.

[0009] Optionally, after obtaining the data packets to be trained, the method includes: dividing the data packets to be trained and the data packets of normal traffic into a training set and a test set according to a preset ratio; using the training set to train the initial deep learning model, and updating the network weights of the initial deep learning model through a back propagation algorithm and an Adam optimizer, and using a cross entropy loss function as a loss function to evaluate the prediction performance of the initial deep learning model; using the test set to test the trained deep learning model to obtain the target deep learning model.

[0010] Optionally, the loss function is:

[0011] ;

[0012] in, is the number of samples, is the true label of the i-th sample, is the model prediction value of the i-th sample.

[0013] The second aspect of the present invention provides a DDoS attack traffic detection device based on deep learning, including: a first acquisition module, used to acquire a current data stream sent by a terminal device, and parse the current data stream to obtain a feature sequence of multiple data packets; a second acquisition module, used to form a time series feature matrix based on the feature sequences of the multiple data packets and input it into a target deep learning model for traffic detection to obtain a model detection result, wherein the target deep learning model is obtained by training an initial deep learning model, and the initial deep learning model is composed of a one-dimensional convolutional neural network, a long short-term memory network layer and a first fully connected layer; a detection module, used to send an alarm message to a display interface if the model detection result is DDoS attack traffic, if the terminal device receives a confirmation indication from the user that the DDoS attack traffic is normal traffic, then determine that the DDoS attack traffic is normal traffic, and self-correct the parameters of the target deep learning model, if the terminal device receives a confirmation indication from the user that the DDoS attack traffic is abnormal traffic, then determine that the DDoS attack traffic is abnormal traffic.

[0014] Optionally, the second acquisition module is also used to: use the convolution layer of the one-dimensional convolutional neural network to capture the spatial dependency between adjacent bytes of different lengths of a single data packet feature sequence in the time series feature matrix to obtain a high-dimensional data feature matrix, and slice the high-dimensional data feature matrix to obtain a data packet-level feature sequence, and input the data packet-level feature sequence into the second fully connected layer of the one-dimensional convolutional neural network to obtain a one-dimensional data stream feature sequence, wherein the one-dimensional convolutional neural network includes two convolutional layers and a second fully connected layer; input the one-dimensional data stream feature sequence into the long short-term memory network layer to obtain an output sequence, and input the output sequence into the first fully connected layer, perform a nonlinear transformation through a first preset activation function, and calculate the probability distribution of the classification through a second preset activation function to obtain the model detection result based on the probability distribution.

[0015] Optionally, before obtaining the current data stream sent by the terminal device, the first acquisition module is also used to: obtain an attack data stream with obvious attack characteristics; use a preset tool to identify and remove invalid data packets in the attack data stream to obtain data packets to be extracted; and classify the data packets to be extracted according to spatiotemporal characteristics, header characteristics, and load characteristics to obtain data packets to be trained.

[0016] Optionally, after obtaining the data packets to be trained, the first acquisition module is also used to: divide the data packets to be trained and the data packets of normal traffic into a training set and a test set according to a preset ratio; use the training set to train the initial deep learning model, and update the network weights of the initial deep learning model through the back propagation algorithm and Adam optimizer, and use the cross entropy loss function as the loss function to evaluate the prediction performance of the initial deep learning model; use the test set to test the trained deep learning model to obtain the target deep learning model.

[0017] Optionally, the loss function is:

[0018] ;

[0019] in, is the number of samples, is the true label of the i-th sample, is the model prediction value of the i-th sample.

[0020] An embodiment of the third aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the deep learning-based DDoS attack traffic detection method as described in the above embodiment.

[0021] A fourth aspect of the present invention provides a computer program product having a computer program stored thereon, which is executed by a processor to implement the deep learning-based DDoS attack traffic detection method as described in the above embodiment.

[0022] In the above implementation, the current data stream sent by the terminal device is obtained, the current data stream is parsed to obtain a feature sequence of multiple data packets, a time series feature matrix is ​​formed based on the feature sequences of the multiple data packets and input into the target deep learning model for traffic detection to obtain a model detection result. If the model detection result is DDoS attack traffic, the terminal device sends an alarm message to the display interface. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic. This solves the problem that although the current strategy for dealing with DDoS attacks can prevent attack behaviors, the attack traffic in a single area may be difficult to detect before it reaches a scale, and the distributed characteristics of botnets increase the difficulty of tracking devices. By combining traffic analysis with deep learning, the model application is deployed on the terminal device. The device can determine whether it is currently under the control of the attacker. When the device is running, the data-sensitive characteristics of the large model are used to dynamically analyze the device's request initiation interval, time change trend, packet-level characteristics, etc. The data stream is classified based on the deep learning method of the sequence characteristics of the data packets in the stream, and compared with the normal user behavior and the abnormal behavior under DDoS control, it is possible to identify whether the device is under the control of the DDoS attacker and decide whether to issue a warning message. The device continuously self-learns and optimizes parameters while it is put into use.

[0023] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0025] Figure 1 A flowchart of a DDoS attack traffic detection method based on deep learning provided according to an embodiment of the present invention;

[0026] Figure 2 A flow chart of a traffic analysis method of a 1DCNN-LSTM model according to an embodiment of the present invention;

[0027] Figure 3 Flow chart of a DDoS attack traffic detection method based on deep learning according to an embodiment of the present invention;

[0028] Figure 4 A schematic diagram of a 1DCNN network structure according to an embodiment of the present invention;

[0029] Figure 5 A schematic diagram of a recurrent unit structure of an LSTM neural network according to an embodiment of the present invention;

[0030] Figure 6 A schematic diagram of the LSTM neural network structure according to an embodiment of the present invention;

[0031] Figure 7 is a flowchart of a full connection processing process according to an embodiment of the present invention;

[0032] Figure 8 This is an example diagram of a DDoS attack traffic detection device based on deep learning according to an embodiment of the present invention;

[0033] Fig. 9 FIG. 4 is a schematic diagram of a structure of an electronic device according to an embodiment of the present invention.

[0034] Reference numerals:

[0035] 10-DDoS attack traffic detection device based on deep learning; 100-first acquisition module; 200-second acquisition module and 300-detection module. DETAILED DESCRIPTION

[0036] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0037] A DDoS attack traffic detection method based on deep learning according to an embodiment of the present invention is described below with reference to the accompanying drawings. In view of the fact that the current strategies for dealing with DDoS attacks mentioned in the above background technology can prevent attack behaviors, the attack traffic in a single area may be difficult to detect when it has not formed a scale, and the distributed characteristics of the botnet increase the difficulty of tracking devices, the present invention provides a DDoS attack traffic detection method based on deep learning, in which the current data stream sent by the terminal device is obtained, the current data stream is parsed to obtain a feature sequence of multiple data packets, a time series feature matrix is ​​formed based on the feature sequences of the multiple data packets and input into a target deep learning model for traffic detection to obtain a model detection result, if the model detection result is DDoS attack traffic, the terminal device sends an alarm message to the display interface, if the terminal device receives a confirmation indication that the user's DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected, if the terminal device receives a confirmation indication that the user's DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic. This solves the problem that although the current strategy for dealing with DDoS attacks can prevent attack behaviors, the attack traffic in a single area may be difficult to detect before it reaches a scale, and the distributed characteristics of botnets increase the difficulty of tracking devices. By combining traffic analysis with deep learning, model applications are deployed on terminal devices to allow the devices to determine whether they are currently under the control of attackers. When the devices are running, the data-sensitive characteristics of large models are used to dynamically analyze the device's request initiation interval, time change trends, packet-level features, etc. The data stream is classified based on the deep learning method of the sequence characteristics of the data packets within the stream, and compared with the normal user behavior and the abnormal behavior under DDoS control, it is possible to identify whether the device is under the control of the DDoS attacker and decide whether to issue a warning message. The system continuously self-learns and optimizes parameters while it is put into use.

[0038] It is important to understand that deep learning is an artificial intelligence method that uses multi-layer neural networks to learn and understand complex data. It autonomously learns deep representation features from a large amount of sample data to identify complex patterns in data of different modalities. Deep learning is a branch of machine learning, but unlike traditional machine learning, deep learning uses more hidden layers and can optimize and refine accuracy.

[0039] Specifically, Figure 1 A flowchart of a DDoS attack traffic detection method based on deep learning provided by an embodiment of the present invention.

[0040] like Figure 1 As shown, the DDoS attack traffic detection method based on deep learning includes the following steps:

[0041] In step S101, a current data stream sent by a terminal device is acquired, and the current data stream is parsed to obtain characteristic sequences of a plurality of data packets.

[0042] In step S102, a time series feature matrix composed of feature sequences of multiple data packets is input into a target deep learning model for traffic detection to obtain a model detection result, wherein the target deep learning model is obtained by training an initial deep learning model, and the initial deep learning model consists of a one-dimensional convolutional neural network, a long short-term memory network layer and a first fully connected layer.

[0043] In step S103, if the model detection result is DDoS attack traffic, the terminal device sends an alarm message to the display interface. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic.

[0044] Specifically, the embodiment of the present invention deploys the target deep learning model to the terminal device in an appropriate manner. The application process of the target deep learning model on the terminal device is as follows: Figure 2 and Figure 3 shown.

[0045] When the terminal device is running, it captures the current data stream sent by the user in real time, parses the feature sequence of each data packet in the current data stream, composes a time series feature matrix and inputs it into the target deep learning model for traffic detection and classification to obtain the binary classification result of the current data stream, that is, the model detection result.

[0046] If the model detection result is DDoS attack traffic, the terminal device will send an alarm and ask the user to confirm the result. If the user confirms that it is normal traffic, the target deep learning model will perform parameter self-correction. If the user confirms that it is DDoS traffic (i.e. abnormal traffic), the target deep learning model needs to be checked for malicious programs. In other cases, the target deep learning model will continue to run, and will be regularly maintained and updated after it is put into use.

[0047] Optionally, in some embodiments, before obtaining the current data stream sent by the terminal device, the process includes: obtaining an attack data stream with obvious attack characteristics; using a preset tool to identify and remove invalid data packets in the attack data stream to obtain data packets to be extracted; and classifying the data packets to be extracted according to spatiotemporal characteristics, header characteristics, and load characteristics to obtain data packets to be trained.

[0048] Optionally, in some embodiments, after obtaining the data packets to be trained, the process includes: dividing the data packets to be trained and the data packets of normal traffic into a training set and a test set according to a preset ratio; training the initial deep learning model using the training set, and updating the network weights of the initial deep learning model through a back propagation algorithm and an Adam optimizer, and using a cross entropy loss function as a loss function to evaluate the prediction performance of the initial deep learning model; and testing the trained deep learning model using the test set to obtain a target deep learning model.

[0049] Furthermore, in some embodiments, a time series feature matrix composed of feature sequences of multiple data packets is input into a target deep learning model for traffic detection to obtain a model detection result, including: using a convolutional layer of a one-dimensional convolutional neural network to capture the spatial dependency between adjacent bytes of different lengths of a single data packet feature sequence in the time series feature matrix to obtain a high-dimensional data feature matrix, and slicing the high-dimensional data feature matrix to obtain a packet-level feature sequence, and inputting the packet-level feature sequence into a second fully connected layer of a one-dimensional convolutional neural network to obtain a one-dimensional data stream feature sequence, wherein the one-dimensional convolutional neural network includes two convolutional layers and a second fully connected layer; inputting the one-dimensional data stream feature sequence into a long short-term memory network layer to obtain an output sequence, and inputting the output sequence into a first fully connected layer, performing a nonlinear transformation through a first preset activation function, and calculating the probability distribution of the classification through a second preset activation function to obtain a model detection result based on the probability distribution.

[0050] In some embodiments, the loss function is:

[0051] ;

[0052] in, is the number of samples, is the true label of the i-th sample, is the model prediction value of the i-th sample.

[0053] Specifically, first obtain the data set required for training the target deep learning model. To establish the target deep learning model, an attack data stream with obvious attack characteristics is required. The attack data stream can be collected by combining actual data and manually generated data. The actual data can be the Czech Technical University (CTU) malware data set (containing four labels: botnet traffic, attack traffic, normal traffic, and background traffic), or intercepted from the available data of different types of terminal devices. The manually generated data can be launched by researchers through different devices and ports to simulate multiple real-life DDoS attacks, and the corresponding data streams can be intercepted from the terminal device as the data source and annotated. These attack data streams (PCAP file format) will be used as the material for feature learning of the large deep learning model.

[0054] Among them, there will be some data packets in the attack data stream due to timeout, error or retransmission. You can use the preset tool, that is, use the Wireshark tool to identify and remove them, extract valid fields from the traffic data as the input feature set (this can be done using the Joy tool), and get the data packets to be extracted. It should be noted that the IP in the traffic data is desensitized, and for the source port number and destination port number, choose to keep the source port number (malicious traffic has a preference for the source port number, and 99% of malicious traffic prefers to use port 443).

[0055] Furthermore, based on the data packets to be extracted, they are classified according to the spatiotemporal features, header features, and load features to obtain the data packets to be trained. Specifically, in the selection of data packet features, the spatiotemporal features, header features, and load features are selected as the basis for traffic classification. The spatiotemporal features include the time attributes (packet sending time, inter-packet delay) and spatial attributes (packet length, packet sending direction, etc.) of normally sent data packets. The header features include the traffic quintuple, DNS and HTTP information. The load features are the content encapsulated in the stream data, such as encryption protocols.

[0056] The data packets to be extracted and the data packets of normal traffic are randomly shuffled and then and The ratio is divided into training set and validation set, satisfying , and ensure that the two types of data are evenly distributed in the two data sets, where each data stream consists of a certain number of data packets, and these data packet features are constructed into a time series. Among them, the structure of the initial deep learning model contains a one-dimensional convolutional neural network (1DCNN), a long short-term memory network layer (LSTM) and the first fully connected layer.

[0057] Furthermore, the training set is used to train the initial deep learning model, and the network weights of the initial deep learning model are updated through the back-propagation algorithm and the Adam optimizer. The cross-entropy loss function is used as the loss function to evaluate the prediction performance of the initial deep learning model. The trained deep learning model is tested with the test set to obtain the target deep learning model.

[0058] Among them, the one-dimensional convolutional neural network (1DCNN) includes two convolutional layers (the convolution kernels are ) and the second fully connected layer, such as Figure 4 As shown in the figure, the one-dimensional convolutional layer is responsible for capturing the spatial dependencies between adjacent bytes of different lengths in the feature sequence corresponding to a single network data packet, extracting higher-dimensional data features, while retaining the original time series features of the feature matrix, slicing the obtained feature matrix, extracting the packet-level feature sequence and inputting it into the second fully connected layer, and finally obtaining a one-dimensional data stream feature sequence.

[0059] The three gate values ​​of the LSTM layer are between (0, 1), indicating the restrictions on information passing through the three gates, such as Figure 5 As shown, the calculation formulas for the three gates are as follows:

[0060]

[0061]

[0062]

[0063] in, is the sigmoid function, with a value range of (0,1). As the input of the current time node, Represents the external state of the previous time node. The calculation process of the LSTM layer is divided into the following three steps:

[0064] (1) Through the external state at the previous time point and the input of the current time node , for three gates and candidate states Perform calculations;

[0065] (2) Through the forget gate and input gate Memory Unit Make updates;

[0066] (3) Through the output gate Passing internal state information to external state .

[0067] The working principle diagram of LSTM network layer is as follows Figure 6As shown, is the high-dimensional feature of a selected data packet, The output sequence is a data stream feature sequence composed of high-dimensional features of a single data packet. , and finally the output sequence Send it to the first fully connected layer, such as Figure 7 As shown, the first preset activation function (Sigmoid function) is then used to perform a nonlinear transformation on the feature vector, and finally the second preset activation function (SoftMax function) is used to calculate the probability distribution of the classification to obtain the model detection result based on the probability distribution.

[0068] In summary, the advantages of the embodiments of the present invention are:

[0069] 1. In the feature selection of traffic classification, the embodiment of the present invention adopts a method combining experience selection and model autonomous learning features, which can retain valid features (such as source port) and avoid the overfitting effect of specific data (such as IP) on the classification results.

[0070] 2. The embodiment of the present invention adopts a 1DCNN-LSTM model structure, which retains the original time series information while extracting high-dimensional features, and can automatically learn and extract key features in traffic data and capture dynamic changes in traffic patterns.

[0071] 3. The embodiment of the present invention uses the sequence features of data packets within the flow for training, does not rely on the original content of the data packets, and can be applied to encrypted traffic to protect the privacy of user data.

[0072] 4. Improve the intelligent detection level of terminal device output traffic and improve the security of terminal devices.

[0073] According to the deep learning-based DDoS attack traffic detection method proposed in an embodiment of the present invention, the current data stream sent by the terminal device is obtained, the current data stream is parsed to obtain a feature sequence of multiple data packets, a time series feature matrix is ​​composed based on the feature sequences of the multiple data packets and input into a target deep learning model for traffic detection to obtain a model detection result. If the model detection result is DDoS attack traffic, the terminal device sends an alarm message to a display interface. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic. This solves the problem that although the current strategy for dealing with DDoS attacks can prevent attack behaviors, the attack traffic in a single area may be difficult to detect before it reaches a scale, and the distributed characteristics of botnets increase the difficulty of tracking devices. By combining traffic analysis with deep learning, model applications are deployed on terminal devices to allow the devices to determine whether they are currently under the control of attackers. When the devices are running, the data-sensitive characteristics of large models are used to dynamically analyze the device's request initiation interval, time change trends, packet-level features, etc. The data stream is classified based on the deep learning method of the sequence characteristics of the data packets within the stream, and compared with the normal user behavior and the abnormal behavior under DDoS control, it is possible to identify whether the device is under the control of the DDoS attacker and decide whether to issue a warning message. The system continuously self-learns and optimizes parameters while it is put into use.

[0074] Next, a DDoS attack traffic detection device based on deep learning proposed in accordance with an embodiment of the present invention is described with reference to the accompanying drawings.

[0075] Figure 8 It is a block diagram of a DDoS attack traffic detection device based on deep learning according to an embodiment of the present invention.

[0076] like Figure 8 As shown, the deep learning-based DDoS attack traffic detection device 10 includes: a first acquisition module 100, a second acquisition module 200 and a detection module 300.

[0077] Among them, the first acquisition module 100 is used to obtain the current data stream sent by the terminal device, and parse the current data stream to obtain the feature sequence of multiple data packets; the second acquisition module 200 is used to form a time series feature matrix based on the feature sequences of multiple data packets and input it into the target deep learning model for traffic detection to obtain a model detection result, wherein the target deep learning model is obtained by training the initial deep learning model, and the initial deep learning model is composed of a one-dimensional convolutional neural network, a long short-term memory network layer and a first fully connected layer; the detection module 300 is used to send an alarm message to the display interface if the model detection result is DDoS attack traffic, if the terminal device receives a confirmation indication that the user's DDoS attack traffic is normal traffic, then the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected, if the terminal device receives a confirmation indication that the user's DDoS attack traffic is abnormal traffic, then the DDoS attack traffic is determined to be abnormal traffic.

[0078] Optionally, in some embodiments, the second acquisition module 200 is also used to: use the convolution layer of the one-dimensional convolutional neural network to capture the spatial dependency between adjacent bytes of different lengths of a single data packet feature sequence in the time series feature matrix to obtain a high-dimensional data feature matrix, and slice the high-dimensional data feature matrix to obtain a data packet-level feature sequence, and input the data packet-level feature sequence into the second fully connected layer of the one-dimensional convolutional neural network to obtain a one-dimensional data stream feature sequence, wherein the one-dimensional convolutional neural network includes two convolutional layers and a second fully connected layer; input the one-dimensional data stream feature sequence into the long short-term memory network layer to obtain an output sequence, and input the output sequence into the first fully connected layer, perform a nonlinear transformation through a first preset activation function, and calculate the probability distribution of the classification through a second preset activation function to obtain a model detection result based on the probability distribution.

[0079] Optionally, in some embodiments, before obtaining the current data stream sent by the terminal device, the first acquisition module 100 is also used to: obtain an attack data stream with obvious attack characteristics; use a preset tool to identify and remove invalid data packets in the attack data stream to obtain data packets to be extracted; and classify the data packets to be extracted according to spatiotemporal characteristics, header characteristics, and load characteristics to obtain data packets to be trained.

[0080] Optionally, in some embodiments, after obtaining the data packets to be trained, the first acquisition module 100 is also used to: divide the data packets to be trained and the data packets of normal traffic into a training set and a test set according to a preset ratio; use the training set to train the initial deep learning model, and update the network weights of the initial deep learning model through the back propagation algorithm and the Adam optimizer, and use the cross entropy loss function as the loss function to evaluate the prediction performance of the initial deep learning model; use the test set to test the trained deep learning model to obtain the target deep learning model.

[0081] Optionally, in some embodiments, the loss function is:

[0082] ,

[0083] in, is the number of samples, is the true label of the i-th sample, is the model prediction value of the i-th sample.

[0084] It should be noted that the aforementioned explanation of the embodiment of the DDoS attack traffic detection method based on deep learning is also applicable to the DDoS attack traffic detection device based on deep learning in this embodiment, and will not be repeated here.

[0085] According to the deep learning-based DDoS attack traffic detection device proposed in an embodiment of the present invention, the current data stream sent by the terminal device is obtained, the current data stream is parsed to obtain a feature sequence of multiple data packets, a time series feature matrix is ​​composed based on the feature sequences of the multiple data packets, and is input into a target deep learning model for traffic detection to obtain a model detection result. If the model detection result is DDoS attack traffic, the terminal device sends an alarm message to a display interface. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected. If the terminal device receives a confirmation indication that the user's DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic. This solves the problem that although the current strategy for dealing with DDoS attacks can prevent attack behaviors, the attack traffic in a single area may be difficult to detect before it reaches a scale, and the distributed characteristics of botnets increase the difficulty of tracking devices. By combining traffic analysis with deep learning, model applications are deployed on terminal devices to allow the devices to determine whether they are currently under the control of attackers. When the devices are running, the data-sensitive characteristics of large models are used to dynamically analyze the device's request initiation interval, time change trends, packet-level features, etc. The data stream is classified based on the deep learning method of the sequence characteristics of the data packets within the stream, and compared with the normal user behavior and the abnormal behavior under DDoS control, it is possible to identify whether the device is under the control of the DDoS attacker and decide whether to issue a warning message. While it is put into use, it continuously self-learns and optimizes parameters.

[0086] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device may include:

[0087] A memory 901 , a processor 902 , and a computer program stored in the memory 901 and executable on the processor 902 .

[0088] When the processor 902 executes the program, the DDoS attack traffic detection method based on deep learning provided in the above embodiment is implemented.

[0089] Furthermore, the electronic device further comprises:

[0090] The communication interface 903 is used for communication between the memory 901 and the processor 902 .

[0091] The memory 901 is used to store computer programs that can be executed on the processor 902 .

[0092] The memory 901 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0093] If the memory 901, the processor 902 and the communication interface 903 are implemented independently, the communication interface 903, the memory 901 and the processor 902 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0094] Optionally, in a specific implementation, if the memory 901, the processor 902 and the communication interface 903 are integrated on a chip, the memory 901, the processor 902 and the communication interface 903 can communicate with each other through an internal interface.

[0095] The processor 902 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0096] An embodiment of the present invention further provides a computer program product having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned DDoS attack traffic detection method based on deep learning.

[0097] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0098] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "N" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0099] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present invention belong.

[0100] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be specifically implemented in any computer program product for use with an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, a "computer program product" can be any device that can contain, store, communicate, propagate or transmit a program for use with an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer program products (a non-exhaustive list) include the following: an electrical connection with one or N wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). Furthermore, the computer program product may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example by optically scanning the paper or other medium and then editing, interpreting or, if necessary, processing it in another suitable manner, and then storing it in a computer memory.

[0101] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0102] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer program product, which, when executed, includes one or a combination of the steps of the method embodiment.

[0103] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer program product.

[0104] The computer program product mentioned above may be a read-only memory, a disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A DDoS attack traffic detection method based on deep learning, characterized in that: The following steps are involved: Deploy a target deep learning model on a terminal device, obtain a current data stream sent by the terminal device, and parse the current data stream to obtain a feature sequence of multiple data packets; Based on the characteristic sequences of the multiple data packets, a time series characteristic matrix is ​​input into a target deep learning model for flow detection to obtain a model detection result, wherein the target deep learning model is obtained by training an initial deep learning model, and the initial deep learning model is composed of a one-dimensional convolutional neural network, a long short-term memory network layer, and a first fully connected layer; If the model detection result is DDoS attack traffic, the terminal device sends an alarm message to the display interface. If the terminal device receives a confirmation indication from the user that the DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected. If the terminal device receives a confirmation indication from the user that the DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic. The feature sequences based on the multiple data packets form a time series feature matrix and input it into the target deep learning model for traffic detection to obtain a model detection result, including: using the convolution layer of the one-dimensional convolutional neural network to capture the spatial dependency between adjacent features of a single data packet feature sequence in the time series feature matrix to obtain a high-dimensional data feature matrix, slicing the high-dimensional data feature matrix to obtain a data packet-level feature sequence, and inputting the data packet-level feature sequence into the second fully connected layer of the one-dimensional convolutional neural network to obtain a one-dimensional data stream feature sequence, wherein the one-dimensional convolutional neural network includes two convolutional layers and a second fully connected layer; inputting the one-dimensional data stream feature sequence into the long short-term memory network layer to obtain an output sequence, and inputting the output sequence into the first fully connected layer, performing a nonlinear transformation through a first preset activation function, and calculating the probability distribution of the classification through a second preset activation function to obtain the model detection result based on the probability distribution.

2. The DDoS attack traffic detection method based on deep learning according to claim 1 is characterized in that: Before obtaining the current data stream sent by the terminal device, include: Obtain attack data streams with obvious attack characteristics; Using a preset tool to identify and remove invalid data packets in the attack data stream to obtain data packets to be extracted; The data packets to be extracted are classified according to spatiotemporal features, header features, and load features to obtain data packets to be trained.

3. The DDoS attack traffic detection method based on deep learning according to claim 2 is characterized in that: After obtaining the data packet to be trained, it includes: Dividing the data packets to be trained and the data packets of normal traffic into a training set and a test set according to a preset ratio; The initial deep learning model is trained using the training set, and the network weights of the initial deep learning model are updated by a back propagation algorithm and an Adam optimizer, and the prediction performance of the initial deep learning model is evaluated using a cross entropy loss function as a loss function; The trained deep learning model is tested using the test set to obtain the target deep learning model.

4. The DDoS attack traffic detection method based on deep learning according to claim 3 is characterized in that: The loss function is: ； in, is the number of samples, is the true label of the i-th sample, is the model prediction value of the i-th sample.

5. A DDoS attack traffic detection device based on deep learning, characterized in that: include: A first acquisition module is used to deploy a target deep learning model on a terminal device, acquire a current data stream sent by the terminal device, and parse the current data stream to obtain a feature sequence of multiple data packets; A second acquisition module is used to input a time series feature matrix composed of feature sequences of the multiple data packets into a target deep learning model for traffic detection to obtain a model detection result, wherein the target deep learning model is obtained by training an initial deep learning model, and the initial deep learning model is composed of a one-dimensional convolutional neural network, a long short-term memory network layer and a first fully connected layer; A detection module, configured to, if the model detection result is DDoS attack traffic, the terminal device sends an alarm message to a display interface; if the terminal device receives a confirmation indication from the user that the DDoS attack traffic is normal traffic, the DDoS attack traffic is determined to be normal traffic, and the parameters of the target deep learning model are self-corrected; if the terminal device receives a confirmation indication from the user that the DDoS attack traffic is abnormal traffic, the DDoS attack traffic is determined to be abnormal traffic; The second acquisition module is also used to: use the convolution layer of the one-dimensional convolutional neural network to capture the spatial dependency between adjacent features of a single data packet feature sequence in the time series feature matrix to obtain a high-dimensional data feature matrix, slice the high-dimensional data feature matrix to obtain a data packet-level feature sequence, and input the data packet-level feature sequence into the second fully connected layer of the one-dimensional convolutional neural network to obtain a one-dimensional data stream feature sequence, wherein the one-dimensional convolutional neural network includes two convolutional layers and a second fully connected layer; input the one-dimensional data stream feature sequence into the long short-term memory network layer to obtain an output sequence, and input the output sequence into the first fully connected layer, perform nonlinear transformation through a first preset activation function, and calculate the probability distribution of the classification through a second preset activation function to obtain the model detection result based on the probability distribution.

6. The DDoS attack traffic detection device based on deep learning according to claim 5 is characterized in that: Before acquiring the current data stream sent by the terminal device, the first acquisition module is further used to: Obtain attack data streams with obvious attack characteristics; Using a preset tool to identify and remove invalid data packets in the attack data stream to obtain data packets to be extracted; The data packets to be extracted are classified according to spatiotemporal features, header features, and load features to obtain data packets to be trained.

7. An electronic device, characterized in that: Including memory and processor; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the deep learning-based DDoS attack traffic detection method as described in any one of claims 1 to 4.

8. A computer program product having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the DDoS attack traffic detection method based on deep learning as described in any one of claims 1 to 4.

Images